Cellular radiotelephone system with remotely programmed mobile stations

ABSTRACT

A cellular radiotelephone system ( 10 ) includes mobile stations ( 28 ) which may be remotely programmed from a customer activation system ( 12 ) to effect activation and other programming needs. Mobile stations ( 28 ) are manufactured in a blank form that causes them to operate only in an inactive state. During activation, information describing the mobile station&#39;s electronic serial number (ESN) is collected along with area of use information. A mobile identification number (MIN) is assigned in response to the area of use information. A page message is directed to the mobile station operating in its inactive state, but the page message references the mobile station&#39;s ESN. While inactive, the mobile station ( 28 ) detects pages directed to its ESN. A remote programming session is then performed wherein digital user-specific programming data, including the newly assigned MIN, are transferred to the mobile station ( 28 ) over a voice channel using a control channel protocol ( 80 ).

RELATED APPLICATIONS

The present patent application is a Continuation of “CellularRadiotelephone System With Remotely Programmed Mobile Stations,” byRobert G. Zicker, et al., Ser. No. 09/510,712, filed Feb. 22, 2000,abandoned; which is a Continuation of “Cellular Radiotelephone SystemWith Remotely Programmed Mobile Stations,” by Robert G. Zicker, et al.,Ser. No. 09/363,901, filed Jul. 28, 1999, issued Sep. 19, 2000 as U.S.Pat. No. 6,122,523; which is a Continuation of “Cellular RadiotelephoneSystem With Remotely Programmed Mobile Stations,” by Robert G. Zicker,et al., Ser. No. 09/124,268, filed Jul. 29, 1998, issued Oct. 17, 2000as U.S. Pat. No. 6,134,435; which is a Continuation of “CellularRadiotelephone System With Remotely Programmed Mobile Stations,” byRobert G. Zicker, et al., Ser. No. 09/020,324, filed Feb. 6, 1998,issued Mar. 2, 1999 as U.S. Pat. No. 5,878,339; which is a Continuationof “Cellular Radiotelephone System With Remotely Programmed MobileStations,” by Robert G. Zicker, et al., Ser. No. 08/315,010, filed Sep.29, 1994, abandoned; which is a Continuation-In-Part of “Multiple ModePersonal Wireless Communications System,” by Robert G. Zicker, et al.,Ser. No. 08/201,445, filed Feb. 24, 1994, issued Jan. 14, 1997 as U.S.Pat. No. 5,594,782; all of which are incorporated herein by reference.

TECHNICAL FIELD OF THE INVENTION

The present invention relates generally to cellular radiotelecommunication systems. More specifically, the present inventionrelates to the control of user-specific programming stored in and actedupon by mobile stations.

BACKGROUND OF THE INVENTION

Mobile stations used in connection with conventional cellulartelecommunication systems are manufactured in a blank or unprogrammedstate. An activation process is performed both to acquire customeridentification information so that customers may be successfully billedfor communication services and to personalize the mobile stations sothat they will be capable of providing communication services. Until amobile station has been activated, it can neither make nor receive acall. After activation, changes in either customer preferences or systemoperating characteristics can require changes to the mobile stations'personalization.

Personalization is accomplished by causing the mobile station to includecertain user-specific programming. The user-specific programmingrepresents data which cause the mobile station to function as desiredfor a specific user. Examples of user-specific programming include, butare not limited to, a mobile identification number (MIN) and home systemidentification (SID). The MIN represents the mobile station's phonenumber, and the home SID represents the identification of the cellularsystem with which the user has contracted to provide communicationservices.

Activation is currently accomplished through two different techniques.In accordance with one activation technique, a skilled servicerepresentative collects data from a new customer, uses a computer indata communication with an on-line computerized customer activationsystem to obtain a valid MIN, and manually operates the mobile station'skeypad to program the MIN and other user-specific programming in themobile station. In accordance the second technique, preprogrammed mobilestations are stocked in retail stores so that no user-specificprogramming need be keyed into the mobile station keypad. Bothtechniques have undesirable consequences.

The technique of requiring a skilled service representative to programmobile stations forces new customers to go out of their way to visit aservice representative. This is an inconvenience to customers and limitsthe availability of mobile stations in mass markets. Moreover, thistechnique is error prone because the human factor is involved inhand-keying user-specific programming into mobile stations. It is alsoexpensive because of labor costs associated with making a sufficientnumber of skilled service representatives available to the generalpublic. In addition, the expense and error-prone nature of thistechnique are exacerbated because the programming sequences aretypically cryptic, different mobile station manufacturers use differentprogramming sequences, and the programming sequences change as newmobile station models become available.

The second technique of stocking preprogrammed mobile stations addressessome of the problems associated with using skilled servicerepresentatives to hand-key user-specific programming into mobilestations. However, this second technique increases activation costs dueto the need to inventory and track mobile stations that differ only intheir user-specific programming. In addition, user-specific programmingis typically configured to fit general customer profiles rather than anindividual customer's preferences. It also leads to confusion in theassignment of MINS. For example, MINs are assigned well in advance ofwhen the mobile station is actually sold. The MIN is allocated for aparticular area or location of use, typically at the location of theretail store where the mobile station is sold. However, the customer mayseldom or never actually use the mobile station near the store.Consequently, the customer may get a mobile station with a MIN which isnot appropriate for the customer's actual area of use.

The problems associated with the above two techniques for activatingmobile stations could, in large part, be eliminated through the use of aremotely programmable mobile station. While a few remotely programmablemobile stations have been devised, they cannot be remotely programmedfor activation. Conventional remotely programmable mobile stationsrequire the mobile station to be activated before they may be remotelyprogrammed. Prior activation is required because the mobile stationsaccomplish remote programming by making or receiving a call, but theycan neither make nor receive a call until after activation. In addition,conventional remotely programmable mobile stations use ubiquitoustelecommunications modem technology to receive the user-specific data. Asecurity risk results due to the coupling of mobile stations to a publicnetwork and the widespread availability of modem technology in thegeneral population.

SUMMARY OF THE INVENTION

Accordingly, it is an advantage of the present invention that animproved cellular system having remotely programmed mobile stations isprovided.

Another advantage of the present invention is that mobile stations maybe remotely programmed for user-specific activation programming and forsubsequent alterations in the user-specific programming.

Another advantage is that the present invention provides remoteprogramming without requiring the use of ubiquitous conventionaltelecommunications modem technology.

Another advantage is that the present invention provides for the secureremote programming of certain mobile stations without requiringsignificant changes to the existing cellular telecommunicationsinfrastructure.

The above and other advantages of the present invention are carried outin one form by a method of operating a cellular telecommunicationssystem to manage user-specific programming stored in mobile stations, tomanage signalling between one or more land stations and the mobilestations, and to manage the transfer of user information to and from themobile stations. The method calls for communicating between a landstation and a mobile station using one of either a digital data mode oran analog audio mode. The land station is operated in cooperation withthe mobile station so that the digital data mode is used to communicateboth signalling and the user-specific programming. In addition, the landstation is operated in cooperation with the mobile station so that theanalog audio mode is used to communicate the user information.

BRIEF DESCRIPTION OF THE DRAWINGS

A more complete understanding of the present invention may be derived byreferring to the detailed description and claims when considered inconnection with the Figures, wherein like reference numbers refer tosimilar items throughout the Figures, and:

FIG. 1 shows a telecommunications system which may incorporate thepresent invention;

FIG. 2 shows a block diagram of a mobile station configured inaccordance with the present invention;

FIG. 3 shows a flow chart of a process performed by a customeractivation system (CAS);

FIG. 4 shows a data format diagram of a three word page response messagesent over a reverse control channel;

FIG. 5 shows a data stream protocol diagram of a control channelprotocol;

FIG. 6 shows a flow chart of a process performed by a land station;

FIG. 7 shows a data format diagram of a two word mobile station controlmessage sent over a forward control channel;

FIG. 8 shows a flow chart of a process performed by a mobile station;

FIG. 9 shows a data stream protocol diagram of a voice channel protocol;and

FIG. 10 shows a flow chart of a process performed by the mobile stationduring a remote programming session.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

FIG. 1 shows a block diagram of a telecommunications system 10 which mayincorporate the present invention. Telecommunications system 10 includesa customer activation system (CAS) 12 with any number of servicerepresentative operator stations 14 located nearby. CAS 12 isimplemented using a conventional computer system. Operator stations 14couple to a public switched telecommunications network (PSTN) 16 orother communications network through a conventional local loop so that aservice representative may engage in telephonic voice conversations withcustomers and prospective customers. CAS 12 couples to a trunk 20supplied through PSTN 16. Any number of additional telecommunicationsdevices 22 may also couple to PSTN 16 to engage in the communication ofaudio, video, data, or other user information.

PSTN 16 desirably extends trunk 20 to a mobile telecommunicationsswitching office (MTSO) 24. For the most part, MTSO 24 has aconventional structure and performs processes which are conventional inthe art of cellular telephony, and more particularly in accordance withconventional cellular telephony standards established for the UnitedStates of America and other countries, as set forth in Standard EIA-553and elsewhere. MTSO 24 couples to any number of land stations 26, whichlikewise have generally conventional structures and generally performconventional processes. However, processes performed by MTSO 24 and landstations 26 diverge from conventional processes in the manner set forthbelow. Land stations 26 may represent cell sites, base stations, and thelike, which may manage radio communications over control channels and/orvoice channels so that mobile stations 28 may receive telecommunicationsservices. However, land stations 26 are not limited to use only as acell site but may also be used for a personal or private communicationssystem. In addition, while the “land station” terminology is consistentwith the conventional cellular telephony lexicon, land stations are notlimited to being coupled to land lines and may couple to MTSO 24 orother controlling stations through RF links.

Mobile stations 28 may communicate user information through the voicechannels to other mobile stations 28, telecommunications devices 22, oreven operator station 14. Generally, mobile stations 28 are intended tobe used while in motion or during halts at unspecified points. However,mobile stations 28 include hand-held units, vehicle-mounted units,portable units, and units which are physically configured for use onlyat permanent stationary locations.

User information is communicated when a call is setup and a land station26 and mobile station 28 operate in an analog audio mode to communicateanalog audio signals. Consequently, voice communications are directlytranslated into electronic user information, and digital data may betranslated into electronic user information through the use of modems(not shown) which translate digital data into analog audio signals.

Likewise, mobile stations 28 may transmit and receive digital signallingdata. Signalling data are generally communicated to allocate andotherwise manage the channels over which communications are to takeplace and to indicate a desire to engage in transmitting userinformation over the voice channels. Generally, signalling data aretransparent to users. Signalling data are communicated when a landstation 26 and mobile station 28 operate in a digital data mode tocommunicate digital data. In the preferred embodiment, digitalsignalling data are communicated using a 10 Kbit, Manchester encoded,FSK digital communication scheme which is well known in the cellulartelephony art.

In accordance with the present invention, user-specific programming iscommunicated between CAS 12 and mobile stations 28. User-specificprogramming generally represents digital data and/or executableinstructions which personalize or otherwise configure a mobile station28 so that it may be used to communicate user information and otherwiseprovide communication services in a manner desired by a customer.Examples of typical user-specific programming include a mobileidentification number (MIN), home system identification (SID), “A” or“B” system selection criteria, feature package identification, localarea dialing rules, and the like. In addition, user-specific programmingmay include programming instructions which are executed by amicroprocessor within mobile station 28 to cause mobile station 28 tofunction in any particular manner. Further, for purposes of the presentinvention, user-specific programming also includes an instruction which,when executed by a mobile station 28, deactivates the mobile station 28so that it cannot be used to communicate user information. User-specificprogramming is communicated when a land station 26 and mobile station 28operate in a digital data mode to communicate digital data using the 10Kbit communication scheme that conventional cellular telephony devicesare designed to accommodate. Thus, no extra modems are required tocommunicate user-specific programming, the expense of the extra modemsmay be eliminated, and the security risk of being vulnerable to unwantedprogramming through ubiquitous modem technology available throughout theworld is avoided.

Mobile stations 28 may be remotely programmed even to effect their ownactivation. Desirably, mobile stations 28 are manufactured, distributed,stocked, and sold in a blank, unpersonalized form where they areconfigured to operate only in an inactive mode. Mobile stations 28 mayinclude certain default user-specific programming which may make mobilestation 28 usable, although not necessarily as desired by certaincustomers.

However, inactive mobile stations 28 do not include a valid MIN. Thoseskilled in the art will appreciate that a MIN represents a telephonenumber assigned to a mobile station 28. The MIN is desirably assignedbased upon the customer's area of use for the mobile station 28. Forexample, area codes and central office codes need to correspond to thelocations where the mobile station 28 is most likely to be used so thatthe mobile station 28 will not be roaming and otherwise get assessedwith excessive fees for the majority of calls and so that incoming callsmay be successfully routed to the mobile station 28. Thus, a valid MINis assigned in the course of activating a mobile station 28, and thisMIN is a location-dependent code consistent with an area code andcentral office code corresponding to the areas where mobile station 28will most likely be used. PSTN 16 uses the MIN in routing calls toparticular MTSOs 24, and cellular systems use MINs to route calls to andfrom specific mobile stations 28.

While an inactive mobile station 28 does not have a MIN or at least avalid MIN, it does have an electronic serial number (ESN). The ESNuniquely identifies the mobile station 28 to any cellular system and isconfigured so that it may not be readily changed. The ESN is assigned inaccordance with a manufacturer's code and another code which is uniqueto the manufacturer. The ESN does not designate any area of use and istherefore a location-independent code which conveys no informationuseful to PSTN 16 in routing calls to the mobile station 28 to which itis assigned.

FIG. 1 shows a sales kiosk 30 which may be used in the activation of amobile station 28′. Sales kiosk 30 and CAS 12 are typically remotelylocated from one another, and may in some situations be locatedthousands of miles away from one another. Desirably, sales kiosk 30 maybe located in a retail store where mobile stations 28 are sold to massmarkets, and any number of sales kiosks 30 may be supported by CAS 12.

Sales kiosk 30 represents a telecommunications device which couples toPSTN 16 through a local loop. When a customer wishes to purchase mobilestation 28′,the customer may physically take mobile station 28′ to saleskiosk 30 and use sales kiosk 30 to engage in a voice conversationthrough PSTN 16 with a service representative at a station 14. Throughthis voice conversation, the service representative may collect useractivation information from the customer and enter this information intoCAS 12. Such information includes the identifying data which permits acellular service provider to successfully bill for communicationservices. It also includes the ESN for mobile station 28′, which acustomer may, for example, recite from reading a tag affixed to mobilestation 28′. In addition, the activation information includes locationdata which inform the service representative where mobile station 28′ ismost likely to be used. This information may be inferred from thecustomer's address and the address of sales kiosk 30, and/or directlyobtained from a conversation with the customer. Through the voiceconversation, the customer may select preferred feature packages and thelike.

When the activation information has been gathered, and preferably whilethe voice conversation is ongoing, CAS 12 automatically causes an“activation call” to be placed to mobile station 28′. The appropriateMTSO 24 to use for this call is selected by CAS 12 in response to anaddress of the sales kiosk 30 where mobile station 28′ is currentlylocated. Processes which are discussed below are performed in CAS 12,MTSO 24, land stations 26, and mobile station 28′ so that mobile station28′ will recognize and respond to the call by using a paging messagewhich references the mobile station's ESN. Once a data link isestablished, a remote programming session is performed whereuser-specific programming, including a newly assigned MIN, istransferred to mobile station 28′ and stored therein. At the conclusionof the remote programming session, mobile station 28′ may be used tocommunicate user information.

FIG. 2 shows a block diagram of electronic hardware included in a mobilestation 28 which is configured in accordance with the requirements ofsystem 10. An antenna 32 of mobile station 28 couples to a first port ofa duplexer 34, while a second port of duplexer 34 is adapted to receivea modulated RF signal provided by a transmitter 36 and a third port ofduplexer 34 provides a received RF signal to an input of a receiver 38.An audio output from receiver 38 couples to a speaker 40, and an audioinput to transmitter 36 couples to a microphone 42. Transmitter 36receives analog audio signals from microphone 42 and receiver 38provides analog audio signals to speaker 40 when mobile station 28operates in its analog audio mode. Although not shown, a modem maycouple to or otherwise be switched into these analog audio paths so thatdigital data converted into an analog audio form may be communicated ina conventional manner while mobile station 28 operates in its analogaudio mode.

A controller 44 controls the operation of mobile station 28. Controller44 may be implemented using one or more commercially availablemicroprocessors. Controller 44 provides controlling signals totransmitter 36 and to receiver 38 over data lines 46 and 48,respectively. In addition, controller 44 provides digital data to adigital data input 50 of transmitter 36 for transmission while mobilestation 28 operates in its digital data mode and receives digital datafrom a digital data output 52 of receiver 38 while mobile station 28operates in its digital data mode. In the preferred embodiment, thecontrolling signals applied over data lines 46 and 48 identify frequencychannels to which transmitter 36 and receiver 38 are instructed to tune,and they specify whether transmitter and receiver 36 and 38,respectively, are to operate in the analog audio mode or digital datamode.

A display 54 couples to controller 44 and visually shows informationprovided thereto by controller 44. A keypad 56 couples to controller 44so that controller 44 may detect key presses and then appropriatelyrespond to the key presses. A timer 58 couples to controller 44 andhelps controller 44 monitor the passage of time. In addition, a memory60 couples to controller 44. Memory 60 stores data, variables, tables,lists, and databases that are used in connection with the operation ofmobile station 28. In addition, memory 60 stores programminginstructions which are executed by controller 44 and define the variousprocesses, procedures, routines, tasks, and the like performed bycontroller 44 and mobile station 28. In the preferred embodiments,memory 60 is partitioned into three components. A random access memory(RAM) component 62 represents volatile read/write memory. Anelectrically erasable programmable read only memory (EEPROM) component64 provides non-volatile read/write memory, and a read only memory (ROM)component 66 represents non-volatile, read only memory which cannot beeasily erased or otherwise altered. Those skilled in the art willappreciate that ROM component 66 may be implemented using PROMS, EPROMS,and the like.

Desirably, default user-specific programming is stored both in ROM 66and EEPROM 64 when mobile station 28 is manufactured and sold to acustomer. This default userspecific programming includes an invalid MINand an invalid home SID, along with a factory setting for a keypad lockcode and an index to a predetermined default features package. Due atleast in part to the use of an invalid MIN, mobile station 28 cannotengage in calls which communicate user information at this point. ROM 66also stores the location-independent ESN for mobile station 28 and dataidentifying all control channels used by “A” and “B” cellular systems.

FIG. 3 shows a flow chart of a process 68 performed by customeractivation system (CAS) 12. CAS process 68 is performed whenuser-specific programming needs to be remotely programmed into one ormore mobile stations 28, such as may occur during activation. While FIG.3 specifically illustrates program flow for an activation, a similarprocess may be followed for other remote programming sessions which mayoccur after activation. As indicated by ellipsis in FIG. 3, process 68may perform many tasks which are not directly related to writinguser-specific programming to mobile stations 28. Such tasks may includethe capture and maintenance of customer identification and billingrecords. Process 68 performs a task 70 to collect customer activationdata. This activation data desirably include information describing thearea where the mobile station 28 will most often be used, where themobile station 28 is currently located, the mobile station's ESN, andother data. Task 70 may be performed with the cooperation of a servicerepresentative who is engaging in a voice telephone conversation with acustomer who may be located at a sales kiosk 30 (see FIG. 1).

After task 70, a task 72 assigns a valid MIN to the mobile station 28 inresponse to the area of use identified above in task 70. This area ofuse may, but need not, include the location of sales kiosk 30. Theassigned MIN represents a 10 digit phone number that is not currently inuse elsewhere, and has an area code and office code consistent with theMTSO 24 (see FIG. 1) for this area of use. Next, a task 74 encrypts themobile station's ESN into an invalid MIN format.

FIG. 4 shows a data format diagram of a three word page response message76 sent by a mobile station 28 over a reverse control channel to a landstation 26. Message 76 follows conventional cellular telephonystandards. As FIG. 4 illustrates, the MIN is formatted as a 34-bitbinary number having a first portion (MIN1) conveyed by a first word anda second portion (MIN2) conveyed by a second word. The ESN is a 32-bitbinary number that is conveyed by a third word.

Referring back to FIG. 3, task 74 applies the mobile station's 32-bitESN to an encryption algorithm which generates a 34-bit encryptedESN-MIN, and the 34-bit ESN-MIN is formatted as though it were aninvalid MIN. The use of an invalid MIN format guarantees that noactivated mobile station 28 will accidentally recognize the encryptedESN as its MIN. An invalid MIN may be obtained by, for example, forcingthe first digit of the decimal form of the ESN-MIN to a value of zero.The particular encryption algorithm implemented at task 74 is notrelevant to the present invention, and this algorithm may useconventional public or private key encrypting techniques. As discussedbelow in more detail, the ESN-MIN will be used in lieu of a MIN to pagethe mobile station 28. The use of encryption further enhances securityby reducing the risk of third party meddling with mobile stationprogramming.

After task 74, a task 78 forms an activation record containing all theuser-specific programming to be written into the mobile station 28 in anupcoming remote programming session. Desirably, the activation record ismade up of one or more words, where each word includes a parameteridentity (PID) and parameter value (PVAL). The MIN assigned above intask 72 to mobile station 28 represents one of the parameters conveyedin a word, and the activation record may include any number of words.Various PID/PVAL words may also be coded to present instructions tomobile station 28 rather than raw parameter data. Such instructions may,for example, instruct mobile station 28 that the previous PID/PVAL wordwas the last word to be transferred in the remote programming session.In another example, a PID/PVAL word may be coded as a command todeactivate mobile station 28 and thereby undo the user-specificprogramming specified in a previous activation.

In addition, task 78 arranges the PID/PVAL words in accordance with amobile station control message delivered using a control channelprotocol 80. FIG. 5 shows a data stream protocol diagram of controlchannel protocol 80 for a message that conveys one word of data.Protocol 80 is a conventional user-inaccessible protocol used incellular telephony for control channel digital data communication. Itconveys one 40-bit word for each 463-bit message. As illustrated in FIG.5, protocol 80 includes a 10-bit dotting sequence plus a busy/idle bit,followed by an 11-bit word sync pattern plus a busy/idle bit, followedby five interleaved repetitions of an “A” stream 40-bit word and a “B”stream 40-bit word, wherein a busy/idle bit is inserted for each 10 bitsof the A and B stream words. Conventionally, the “A” stream isdistinguished from the “B” stream by the least significant bit (LSB) ofthe MIN to which the streams are directed. Thus, task 78 may repeat thePID/PVAL words in the “A” or “B” stream per protocol 80 and the LSB ofthe ESN-MIN generated in task 74 (see FIG. 3), or task 78 may simplyrepeat each PID/PVAL word ten times in each message. Control channelprotocol 80 is executed on an assigned voice channel so thatuser-specific programming may be quickly transferred using as few systemresources as possible. The entire process of remotely activating amobile station 28 should take only a few seconds once the customeractivation information has been collected.

After task 78, a task 82 selects an appropriate MTSO 24 (see FIG. 1)based upon the current location of the mobile station 28 to be remotelyprogrammed, establishes a data link to this MTSO 24, and instructs theMTSO and cellular system it controls to page the ESN-MIN numbergenerated above in task 74. From the cellular system's perspective, theESN-MIN is treated as a valid MIN, and a conventional paging process isperformed. CAS process 68 performs a task 84 to determine whether thepage is eventually successful. If not successful, program control passesto an error handling routine 86 so that an appropriate action may betaken. For the above described activation process, a customer is engagedin an ongoing conversation with a service representative, and the errorroutine 86 may simply inform the service representative of the problem.For other remote programming situations, the unsuccessful page maysimply be logged for queuing again at a later time.

When the page is successful, a task 88 sends the next user-specificprogramming message from the activation record formed above in task 78through trunk 20, PSTN 16, MTSO 24, and a land station 26 (see FIG. 1)to mobile station 28. After task 88, a query task 90 waits for either anacknowledgement (ACK) or no acknowledgment (NAK) response from mobilestation 28. Based on the nature of the received response, if any, task90 determines whether the prior message was successful. If it was notsuccessful, a task 92 adjusts a pointer to the activation record formedin task 78 to repeat the last record, and program control loops back totask 88. Although not shown, this loop may include additional tasks tobreak the loop should an excessive number of unsuccessful attempts bemade.

When task 90 determines that the last message was successfullydelivered, a query task 94 determines whether the final message from theactivation record has been delivered. So long as additional messagesremain, program control loops back to task 88 to continue sendingPID/PVAL word messages to mobile station 28. When finished, programcontrol exits process 68 and mobile station 28 has been remotelyactivated.

Process 68 also may be used to remotely program mobile stations 28 whichare currently activated. For post-activation remote programming, task 70may gather the user-specific programming to be downloaded into themobile station 28. Tasks 72 and 74 may substitute the mobile station'sexisting MIN for the encrypted ESN-MIN discussed above. After task 74program flow proceeds as described above, and the mobile station 28 willbe paged using its MIN. Process 68 may also be repetitively performed toremotely program entire populations of mobile stations 28. Thissituation may occur when a cellular system change takes place, such asassigning new area codes or central office codes to a cellular system.In this situation, an entire population of mobile stations 28 requiresupdated user-specific programming reflecting newly assigned MINs.Process 68 may be repeated for each mobile station 28. Task 70 obtains anew MIN, tasks 72 and 74 identify an old MIN, and program flow proceedsas described above, but is repeated for each mobile station 28 in thepopulation.

FIG. 6 shows a flow chart of a process 96 performed by a land station26. While process 96 is directed toward a single land station 26, thoseskilled in the art will appreciate that portions of it may be performedby the MTSO 24 which controls it and by other land stations 26 which arealso controlled by that MTSO 24. As indicated by ellipsis in FIG. 6,process 96 includes many tasks related to managing channels that areallocated to land station 26 and are conventional in cellular telephony.A query task 98 is performed to signal when the land station 26 receivesa page instruction from CAS 12 (see FIGS. 1 and 3). So long as no suchinstruction is received, land station 26 continues to performconventional cellular land station processes.

Desirably, when the page instruction is received, all land stations inthe cellular system controlled by MTSO 24 simultaneously receive thesame instruction. At this point, a task 100 pages the “MIN” specified inthe instruction with a local control order “tune and sync” message. Asdiscussed above, it may be either a valid MIN or the ESN-MIN numberdiscussed above in connection with task 74 (see FIG. 3). Land station 26uses a conventional mobile station control message, such as message 102shown in FIG. 7, and delivers message 102 while operating in its digitalmode over a control channel using control channel protocol 80 (see FIG.5).

Referring briefly to FIGS. 6 and 7, task 100 configures mobile stationcontrol message 102 as a local control order page message by insertingthe MIN, which may be the ESN-MIN during an activation, in MIN1 and MIN2fields of first and second words, by setting an appropriate value(11110) in the order field, and by setting the local field to a codethat mobile station 28 will interpret as a tune and sync command.

Referring back to FIG. 6, after task 100 pages the MIN or ESN-MINobtained from CAS 12, a query task 104 determines whether a pageresponse message 76 (see FIG. 4) was received from the mobile station28. As shown in FIG. 4, the page response message includes the MIN orESN-MIN so that land station 26 can verify that it responded to theprevious local control order page message. If no page response messageis received, program control loops back to task 100. Although not shown,additional tasks may be included to break this loop after a certainnumber of repeated paging attempts have been tried or if an instructionto do so is received via MTSO 24.

When task 104 detects a page response message 76 (see FIG. 4) thatresponds to the tune and sync local control order page messagetransmitted above at task 100, a task 106 finds an idle voice channel,marks the channel busy so that it will not get assigned to other mobilestations 28, and transmits a digital synchronizing signal over theselected voice channel. Moreover, task 106 transmits the synchronizingsignal on the voice channel using control channel protocol 80 (see FIG.5). Task 106 may, for example, continuously transmit its overheadmessage over this voice channel. While task 106 causes land station 26to operate one of its voice channels somewhat like a control channel,nothing requires any alteration in the manner in which land station 26operates its control channel. In other words, control channel overheadand control channel messages continue to be transmitted from landstation 26 over its control channel.

After task 106, a task 108 transmits a voice channel assignment messageover its control channel using the conventional channel assignmentprotocol. Next, a query task 110 causes land station 26 to monitor thevoice channel assigned above in task 106 for a ready message transmittedby mobile station 28. The ready message is sent to land station 26 usinga reverse control channel protocol even though this is a voice channel.Program control stays at task 110 until this ready message is received.However, error handling tasks (not shown) may be included to address thesituation where the mobile station 28 fails to respond with the readymessage.

When task 110 detects the ready message, a task 112 is performed topatch the voice channel to trunk 20 (see FIG. 1) and to inform CAS 12(see FIG. 1) that the page was successful. At this point, CAS 12controls the data link to mobile station 28. Land station 26 exerts nofurther influence over the remote programming session. Rather, CAS 12controls the remote programming session as discussed above in connectionwith FIG. 3. Land station 26 merely performs a query task 114 todetermine when trunk 20 goes inactive. When trunk 20 is dropped, landstation 26 performs a task 116 to tear down the call to mobile station28. As a result of tearing down the call, the voice channel becomes idleagain and may be used an needed to convey user information to and frommobile stations 28.

FIG. 8 shows a flow chart of a process 118 performed by a mobile station28. Process 118 may be performed when mobile station 28 powers up.Mobile station 28 performs various initialization tasks, including atask 120 which causes it to operate in its digital data mode. Asdiscussed above in connection with FIG. 2, in this mode digital data,rather than analog audio signals, are routed through transmitter 36 andreceiver 38. After task 120, a query task 122 determines whether mobilestation 28 is active. Task 122 may, for example, determine whether itsuser-specific programming includes a valid MIN, but other evaluationscan lead to the same conclusion. If mobile station 28 has not beenactivated, then it will operate in its inactive state, and programcontrol proceeds to a task 124.

Task 124 scans control channels, the identities of which are programmedinto mobile station 28, to select a best server control channel. Task124 may monitor a received signal strength indicator (RSSI) when tunedto a control channel to determine whether any received signal exhibitssufficient strength.

After task 124, a task 126 performs a decryption operation whichcomplements the encryption operation discussed above in connection withtask 74 (see FIG. 3). The decryption operation may be performed in atleast two different ways. The mobile station's ESN may be encrypted in amanner similar to that discussed above in connection with task 74 sothat a resulting encrypted ESN-MIN is generated by task 126. ThisESN-MIN may be compared with MINs conveyed from land stations 26 in pagemessages. Alternately, MINs may be parsed from received page messagesand subjected to algorithms which complement the encryption algorithmperformed by CAS 12 in task 74. This “decrypted” MIN may then becompared to the mobile station's ESN.

After task 126, a query task 128 determines whether a tune and synclocal control order page message received from the control channelreferences the mobile station's ESN. Mobile station 28 may continue tomonitor paging messages received over the selected control channel for afew seconds before task 128 decides that no page directed to its ESN hasbeen received. When task 128 makes this determination, program controlloops back to task 124 to select a different control channel and repeatthe process of monitoring for a page message directed to the mobilestation's ESN. In the preferred embodiment, the control channelsselected at task 124 alternate between A and B cellular systems, andtask 124 may select not only the control channels in each system withthe strongest signals, but the control channels with the next strongestsignals.

As discussed above, page messages directed to the mobile station may besimultaneously transmitted from all land stations 26 within a particularcellular system. Thus, a good chance exists that a page will be detectedwithin a few tries. When task 128 detects an ESN referenced tune andsync local control order page message, a task 130 returns theappropriate page response message 76 (see FIG. 4) over the reversecontrol channel. The page response message echoes the ESN-MIN for themobile station's MIN in the response message, and may include the mobilestation's ESN.

After task 130, a query task 132 causes mobile station 28 to wait untilthe voice channel assignment message is received over the controlchannel. However, additional tasks may cause program control to exittask 132 if a voice channel assignment message is not forthcoming. Inaddition, additional tasks may evaluate received messages to determineif some other message or command directed to mobile station 28 isreceived. When the voice channel assignment message is detected, a task134 is performed to tune transmitter 36 and receiver 38 (see FIG. 2) tothe specified voice channel. After task 134, a query task 136 monitorsthe digital data signals and messages received over the voice channeluntil synchronization has been achieved. When mobile station 28 issynchronized to the digital data being transmitted over the voicechannel, a task 138 returns the ready message to the land station 26over the voice channel using a reverse control channel protocol which isnormally used only on control channels.

After task 138, program control proceeds to a remote programming session140, which is discussed in more detail below. During remote programmingsession 140 mobile station 28 continues to operate in its digital modeand its inactive state. Through remote programming session 140,user-specific programming will be communicated to mobile station 28 overthe voice channel using control channel protocol 80 (see FIG. 5). Uponsuccessful completion of a remote programming session 140, mobilestation 28 may be activated and will thereafter operate in its activestate. In its active state, mobile station 28 may operate in either itsanalog audio mode or its digital data mode.

Referring back to task 122, when mobile station 28 decides that it isactive, it operates in its active state to perform numerous tasks, asindicated by ellipsis, which are conventional for cellular mobilestations. These tasks include monitoring control channels to detectincoming calls, tracking changes in channel availability, and monitoringkeypad 56 (see FIG. 2) for user input. A query task 142 represents onesuch conventional mobile station task. Task 142 determines whether a MINreferenced page has been received at mobile station 28. In other words,task 142 determines whether a page message received at mobile station 28conveys the MIN assigned to mobile station 28 through activation.

When task 142 detects a MIN referenced page, a query task 143 determineswhether the page is a tune and sync local control order page message.The local control order page message differs from a page order in thatthe page order informs mobile station 28 of an incoming call and thetune and sync local control order page message informs mobile station 28of an upcoming remote programming session. If task 143 detects a tuneand sync local control order page message, program control proceeds totask 130 to return the page response message and proceed with tuning andsynchronizing to a voice channel as discussed above.

If task 143 determines that the page message was not a tune and synclocal control order page message, then a query task 144 determineswhether an incoming user information call is indicated through a pageorder message. If a user information call is not indicated, then programcontrol proceeds to task 132 to further process the page message todetermine what sort of communication has been received. If a userinformation call is indicated, then mobile station 28 returns a pageresponse message (not shown) and otherwise handles the call in aconventional manner.

In particular, a task 146 causes mobile station 28 to operate in itsanalog audio mode, and a query task 148 causes mobile station 28 toremain in its analog audio mode until the call terminates. When the callterminates, mobile station 28 reverts back to its digital data mode ofoperation, as indicated in a task 150, and program control loops back tothe task 142.

Mobile station 28 switches to its analog audio mode when it receives aninstruction to switch to a voice channel. When operating in the analogaudio mode, both digital data and analog audio communications may takeplace. The analog audio communications convey the user information andaccount for the vast majority of communications which may take place.However, a small amount of signalling may also take place using digitaldata communications. Such signalling includes the communication of handoff messages. Digital data communications which occur over the voicechannel follow a voice channel protocol 152, as shown in FIG. 9. Voicechannel protocol 152 differs significantly from control channel protocol80 (see FIG. 5). Since a continuous stream of data are not provided overthe voice channel, mobile station 28 does not have the opportunity tobecome well synchronized. Thus, voice channel protocol 152 includes a101-bit dotting pattern followed by eleven repeats of a single 40-bitword interleaved with 37-bit dotting sequences and 11-bit word syncpatterns. Voice channel protocol 152 conveys one 40-bit word using 1069bits. Thus, digital data communication using voice channel protocol 152has a greatly reduced data throughput compared to control channelprotocol 80. On the other hand, only a very small amount of digital dataare conveyed using protocol 152.

Accordingly, when mobile station 28 operates in its active state, itcommunicates using both the analog audio mode and the digital data mode.A very small amount of digital signalling data may be communicated inthe analog audio mode, but data throughput suffers due the use of voicechannel protocol 152 which accommodates an inability to achieve thoroughsynchronization. While FIG. 8 illustrates the detection of only MINreferenced pages when mobile station 28 operates in its active state,those skilled in the art will appreciate that nothing preventsadditional tasks from being inserted which might also detect ESNreferenced pages along the lines of tasks 126 and 128.

FIG. 10 shows a flow chart of remote programming session 140 performedby mobile station 28. Generally, remote programming session 140 respondsto and complements the process performed by CAS 12 and discussed abovein connection with FIG. 3. Substantially the same process is performedwhether mobile station 28 receives a MIN referenced page or an ESNreferenced page.

Remote programming session 140 performs a task 153 to receive a messagewhich conveys a PID/PVAL word from CAS 12. The PID/PVAL word is receivedover a voice channel using control channel protocol 80 (see FIG. 5). Asdiscussed above, the PID/PVAL word is repeated several times in thereceived message, and task 153 may vote on the most likely dataconfiguration, verify parity, and perform other verifications whichevaluate whether the parameter value (PVAL) is compatible with thespecified parameter ID (PID). The received PID/PVAL word is stored in atemporary buffer in memory 60 by a task 154, and a task 156 then returnseither an acknowledgment (ACK) or no acknowledgment (NAK) message totell CAS 12 whether to repeat the message or go on to the next message.

After task 156, a query task 158 determines whether the last receiveduser-specific programming message conveyed an end session command. Solong as this command has not been received, program control loops backto task 153. However, additional tasks (not shown) may be included tobreak the loop should no messages be received for an excessive duration.

When task 158 detects the end session command, a query task 160determines whether the PID/PVAL words received include a deactivationcommand. If no deactivation command has been received, a task 162 savesthe temporarily stored parameter values (PVALs) to the appropriatelocations in non-volatile read/write component 64 of memory 60 (see FIG.2). As discussed above, during activation remote programming sessions, avalid MIN and other parameters are down loaded to mobile station 28through the remote programming session. Thus, task 162 causes the validMIN and other parameters to be saved in memory 60. After task 162,program control exits remote programming session 140, and may proceedback to mobile station process 118 (see FIG. 8), where mobile station 28will then operate in its active state.

When task 160 detects a deactivation command, a task 164 retrievesdefault user-specific programming from read only component 66 of memory60. This default user-specific programming includes an invalid MIN, adefault keypad lock code, and other default values. It has the effect ofpreventing mobile station 28 from communicating user information andforcing mobile station 28 to operate in its inactive state. After task164, a task 166 saves this inactive user-specific programming innon-volatile read/write component 64 of memory 60, thereby overwritingany active user-specific programming which may have been previouslystored there. After task 166, program control exits remote programmingsession 140 and may proceed back to mobile station process 118 (see FIG.8), where mobile station 28 will then operate in its inactive state.

The inclusion of an inactive command, when coupled with the securityprecautions provided by the present invention, is advantageous fororganizations which rent or loan mobile stations 28. The deactivationcommand helps such organizations maintain tight control over theirmobile stations 28 by rendering the mobile stations 28 unusable whenusers are not complying with rental or loan arrangements.

While the remote programming session 140 discussed herein is configuredto illustrate the writing of user-specific programming to mobilestations 28, nothing prevents remote programming session 140 fromadditionally being configured to read or audit data stored in mobilestations 28.

In summary, the present invention provides an improved cellular systemhaving remotely programmable mobile stations. The mobile stations may beremotely programmed for user-specific activation programming and forsubsequent alterations in the user-specific programming. The presentinvention provides remote programming without requiring the use ofubiquitous conventional telecommunications modem technology and withoutsuffering the security risks associated therewith. In addition, thesecure remote programming of certain mobile stations is achieved withoutsignificant changes to the existing cellular telecommunicationsinfrastructure. Consequently, it may be successfully implemented atminimal expense.

The present invention has been described above with reference topreferred embodiments. However, those skilled in the art will recognizethat changes and modifications may be made in these preferredembodiments without departing from the scope of the present invention.For example, while the present invention is described herein inconnection with a particular cellular system, the present invention mayalso be used in connection with a wide variety of cellular systems andother radio telecommunication systems. Furthermore, while the presentinvention has been described in connection with a specific programmingflow, those skilled in the art will appreciate that a large amount ofvariation in configuring process tasks and in sequencing process tasksmay be directed to accomplishing substantially the same functions as aredescribed herein. These and other changes and modifications which areobvious to those skilled in the art are intended to be included withinthe scope of the present invention.

What is claimed is:
 1. A wireless telephone configured for activation through an activation call originated from a location remote to said wireless telephone, said wireless telephone comprising: an antenna; a transmitter coupled to said antenna, said transmitter being used to conduct user information calls; a receiver coupled to said antenna, said receiver being used to conduct said activation call and said user information calls; a controller, coupled to said transmitter and to said receiver; and a memory coupled to said controller; wherein said controller is configured to detect a page message received at said receiver during origination of said activation call and referencing a location-independent identifying code stored in said memory.
 2. The wireless telephone of claim 1, wherein said location-independent identifying code is derived from an electronic serial number (ESN) assigned to said wireless telephone.
 3. The wireless telephone of claim 1, wherein said controller is further configured to enter a remote programming mode after detecting said page message.
 4. The wireless telephone of claim 3, wherein after entering said remote programming mode, said controller is configured to accept digital data received by said wireless telephone and to store said digital data in said memory.
 5. The wireless telephone of claim 4, wherein said digital data comprises a home system identification number (SID) for said wireless telephone.
 6. The wireless telephone of claim 4, wherein said digital data comprises a system identification number (SID).
 7. The wireless telephone of claim 4, wherein said digital data comprises a mobile identification number (MIN) for said wireless telephone.
 8. The wireless telephone of claim 4, wherein said digital data comprises an executable instruction. 